Version Control DFIR: GitHub, GitLab, Bitbucket, and Azure DevOps Detection & Incident ...

Your source code is no longer just an intellectual property asset — it is an attack surface, a persistence mechanism, and increasingly, the initial access vector. The recent wave of supply-chain intrusions, from the tj-actions GitHub Actions compromise in March 2025 to the Salesloft Drift OAuth token theft campaign and the Shai-Hulud npm worm that self-propagated through maintainer credentials later in 2025, all a common denominator: attackers treated version control systems (VCS) as both the target and the delivery mechanism. Wiz's recent DFIR cheatsheet for GitHub, GitLab, Bitbucket, and Azure DevOps lands at exactly the right time, because most organizations still have far better telemetry from their endpoints than from the platforms holding their crown jewels.

This post translates that guidance into an operational defensive program: what logs each platform actually gives you, what attacker behavior looks like in those logs, hunt queries you can run today, and how to get your VCS estate incident-ready before you need it.

In every IR engagement I've led involving developer platforms, the same pattern emerges: the SOC has excellent EDR coverage, decent identity telemetry, and almost nothing from the VCS layer. Attackers know this. A compromised personal access token (PAT) or OAuth grant gives an adversary quiet, API-driven access that looks functionally identical to legitimate CI/CD traffic. Repository exfiltration over git protocol or REST API leaves no endpoint artifact if the attacker works entirely through the API from their own infrastructure.

The threat model spans four attacker objectives:

Detection fidelity in VCS DFIR is entirely a function of licensing tier and configuration. This is the uncomfortable truth: on several platforms, the audit events you need most are paywalled or off by default.

A representative 2025–2026 intrusion looks like this: developer phished or token leaked in a public repo → attacker authenticates via REST API from a cloud VPS or residential proxy → enumerates organizations and repositories → creates a PAT or OAuth app for persistence → mass-clones or downloads repo archives → harvests secrets → either exits or escalates to supply-chain poisoning via a tampered workflow file or dependency commit. Every stage of that chain is detectable if you have the right logs centralized.

The detections below target the highest-signal behaviors: persistence creation, audit log tampering, and bulk exfiltration. Tune thresholds (clone counts, distinct repos per actor per hour) to your environment's baseline — a developer laptop and a CI runner behave very differently.

These queries assume GitHub audit log streaming into Sentinel via the GitHub connector or a custom log pipeline ( GitHubAuditLog_CL ), and endpoint telemetry from Defender for Endpoint. Adapt field names to your ingestion schema.

Endpoint forensics matters when the compromise touches developer workstations directly — token theft from credential helpers, malicious clones pulled by malware, or a developer machine used as the pivot. This artifact hunts git credential material and suspicious git execution in one sweep.

The credential-file glob is intentionally broad for hunting, not alerting — .git-credentials files storing plaintext tokens are exactly what infostealers (and the tooling behind the 2025 token-theft campaigns) target. Any hit justifies a deeper look and mandatory token rotation.

This script audits a GitHub organization's incident-readiness posture: SSO enforcement, 2FA requirement, secret scanning, and pending OAuth app visibility. Run it with a token holding admin:org scope, and treat the output as a finding list.

There is no CVE to patch here — the remediation is architectural. Prioritize in this order:

Immediate (this week):

Short-term (this quarter):

Incident response prep:

The Wiz cheatsheet's real message is one I've seen proven across a decade and a half of IR work: the platforms your engineers live in every day are the platforms your adversaries are studying hardest. Endpoint telemetry will catch the phish — but only VCS telemetry will catch what happens after the token is stolen. Centralize the logs, baseline the behavior, and build the detections above into your SOC before the supply-chain headline has your organization's name in it.

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.